CVE-2026-111324 — rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target devic…
Published: 2026-10-15 · CVSS: 6.9 · CVSS 4.0
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7